[HB] Fix Extension sanitize()

src/hb-ot-layout-gpos-private.hh

@@ -1525,7 +1525,8 @@ inline bool ExtensionPos::apply (APPLY_ARG_DEF) const
 inline bool ExtensionPos::sanitize (SANITIZE_ARG_DEF)
 {
   return Extension::sanitize (SANITIZE_ARG) &&
-	 DECONST_CAST (PosLookupSubTable, get_subtable (), 0).sanitize (SANITIZE_ARG);
+	 (&(Extension::get_subtable ()) == &Null(LookupSubTable) ||
+	  DECONST_CAST (PosLookupSubTable, get_subtable (), 0).sanitize (SANITIZE_ARG));
 }
 
 static inline bool position_lookup (APPLY_ARG_DEF, unsigned int lookup_index)

src/hb-ot-layout-gsub-private.hh

@@ -862,7 +862,8 @@ inline bool ExtensionSubst::apply (APPLY_ARG_DEF) const
 inline bool ExtensionSubst::sanitize (SANITIZE_ARG_DEF)
 {
   return Extension::sanitize (SANITIZE_ARG) &&
-	 DECONST_CAST (SubstLookupSubTable, get_subtable (), 0).sanitize (SANITIZE_ARG);
+	 (&(Extension::get_subtable ()) == &Null(LookupSubTable) ||
+	  DECONST_CAST (SubstLookupSubTable, get_subtable (), 0).sanitize (SANITIZE_ARG));
 }
 
 static inline bool substitute_lookup (APPLY_ARG_DEF, unsigned int lookup_index)

src/hb-ot-layout-gsubgpos-private.hh

@@ -769,7 +769,7 @@ struct ExtensionFormat1
 {
   friend struct Extension;
 
-  private:
+  protected:
   inline unsigned int get_type (void) const { return extensionLookupType; }
   inline unsigned int get_offset (void) const { return (extensionOffset[0] << 16) + extensionOffset[1]; }
   inline const LookupSubTable& get_subtable (void) const